hxxp://2001[:]7f8[:]ca[:]1[::]201

Analysis

max time kernel
146s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2023 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://2001:7f8:ca:1::201

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe
4708	msedge.exe
4708	msedge.exe
4824	identity_helper.exe
4824	identity_helper.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 2708	4708	msedge.exe	79
PID 4708 wrote to memory of 2708	4708	msedge.exe	79
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 3376	4708	msedge.exe	81
PID 4708 wrote to memory of 2788	4708	msedge.exe	80
PID 4708 wrote to memory of 2788	4708	msedge.exe	80
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82
PID 4708 wrote to memory of 3456	4708	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://2001:7f8:ca:1::201
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff944df46f8,0x7ff944df4708,0x7ff944df4718
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,2465947542805860123,870323277234073381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,2465947542805860123,870323277234073381,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,2465947542805860123,870323277234073381,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2465947542805860123,870323277234073381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2465947542805860123,870323277234073381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2465947542805860123,870323277234073381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2465947542805860123,870323277234073381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,2465947542805860123,870323277234073381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,2465947542805860123,870323277234073381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2465947542805860123,870323277234073381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2465947542805860123,870323277234073381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2465947542805860123,870323277234073381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,2465947542805860123,870323277234073381,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c89e9212e22e92acc3d335fe9a44fe6

SHA1
c43c7e1b5fb58a40a01a6d8dd947c41a48e0b41f

SHA256
18c46c863404b31fcce434662806fa34daff0f9af0a9379d898f772b5c398b44

SHA512
c6961c171af63ddc7a72aaba4c9d910cc6a424794c416cd1ce51206f7c7f1100ca51c9e41d07d68489105dccded2294c1d761a8dc6be80d22c661014efd6a9ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
61cac2b45c2eb085b3b15d431343b2f5

SHA1
6db7058913340d3f7837475413d4125390efa786

SHA256
0b47b23c2ba2bc73f0d903c4f084e11212c11778a6600147d7b2633df633b970

SHA512
0d99b985238b2be4af15af86c645db8eb9be483753197afcef6348c4c7773d99a08a08ac9b9abf44fa506b3a29913476c69e5e5b541efce2f2ba38f6312e173b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
614fedc1c38a741842e8f030777854a6

SHA1
34e8baa3d43ba9a2c89c83d9dfad23a739bfa14f

SHA256
95c381dfc64bfd2b1d8e44e3bdda357db5a8f944047bde98ee6db9ecb9f5c2fd

SHA512
fea16b5ea5c3b0febb0b036d62de94a55ce4065025a3276d2d79d22d96b0194850fec385f3e81c7dbb86c697251fb25cdbc7c2b6d89381120ad7c00d48eb42cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d7b2b29ef1d9a33e61e1167984c8ca3e

SHA1
9a0da1a3cf9003ecf6aba220a8a00ca34a7ebd34

SHA256
7d4bbec0e8bf4e62f352750240a0bc0f7844d58fea590bc6a9fc972c3b752dc2

SHA512
3cc40b7e35c0749e419b035a73768c8f76bace77ed44be6a59469a032b643da15162733e5aaa94064494b055858a24e4f79326a863f31f1c28eab44cec35cbec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bd0ae4c1529b47998791d748dd8f4613

SHA1
4b1916dc2d08704726e6785a92fb6936cfcea02f

SHA256
e22abb131c6e36c5d093d684b23e75d8f847a2770a044b1252c1e1b76e1ca295

SHA512
5197037fe976543ae2f3a3d1d3ba66a301f6bf31c5ca9dcdf9b6d6500b811789b4db22df91e58c5f309bf6b03441456ca31ca4b4cc5b489033cf9d278ccfa865

Download Submit